@muhkoo/connect 0.7.0-alpha.4 → 0.8.0-alpha.0

package/dist/connect.d.ts

@@ -754,7 +754,13 @@ declare enum EventCoreEvents {
     DATA_SENT = "data_sent",
     MESSAGE = "message",
     GET_HISTORY = "get_history",
-    RECEIVED_HISTORY = "received_history"
+    RECEIVED_HISTORY = "received_history",
+    ONLINE = "online",
+    OFFLINE = "offline",
+    SYNCING = "syncing",
+    SYNC_PROGRESS = "sync_progress",
+    SYNC_COMPLETE = "sync_complete",
+    SYNC_ERROR = "sync_error"
 }
 /**
  * @public
@@ -1399,6 +1405,16 @@ declare function manifestToStat(manifest: FileManifest): FileStat;
  *                             skip a PUT they'd otherwise dedup-rewrite. The
  *                             server can ignore the optimization if it wants.
  */
+/**
+ * A content-addressed byte cache for shards (the offline layer's `ShardCache`
+ * satisfies this structurally). Declared here as a minimal interface so the
+ * storage layer doesn't import the offline module — keeping the dependency
+ * arrow one-way (offline → storage).
+ */
+interface ShardByteCache {
+    get(hash: string): Promise<Uint8Array | null>;
+    put(hash: string, bytes: Uint8Array): Promise<void>;
+}
 interface ShardClientOptions {
     /** Base URL of the accelerator (e.g. `https://muhkoo-accelerator.workers.dev`). */
     baseUrl: string;
@@ -1418,6 +1434,18 @@ interface ShardClientOptions {
      * Provided so callers can inject retries / auth / instrumentation.
      */
     fetch?: typeof fetch;
+    /**
+     * Optional offline byte cache. When present, GETs are served cache-first and
+     * populated on success, and PUTs write the cache before the network so a
+     * just-uploaded file reads back offline. See {@link ShardByteCache}.
+     */
+    cache?: ShardByteCache;
+    /**
+     * Called when a PUT can't reach the network (offline). Lets the caller queue
+     * the upload for replay on reconnect; the bytes are already in {@link cache}
+     * keyed by `hash`, so only the hash needs recording.
+     */
+    deferUpload?: (hash: string) => Promise<void>;
 }
 /**
  * Compute the lowercase hex SHA-256 of `bytes`. Available via WebCrypto in
@@ -1428,6 +1456,8 @@ declare class ShardClient {
     private readonly baseUrl;
     private readonly pathPrefix;
     private readonly fetchFn;
+    private readonly cache?;
+    private readonly deferUpload?;
     constructor(opts: ShardClientOptions);
     /** Build the URL for a given shard hash — exposed for callers that want to log or pre-resolve. */
     urlForHash(hash: string): string;
@@ -2695,6 +2725,8 @@ declare class HttpError extends Error {
 }
 declare class HttpClient {
     readonly baseUrl: string;
+    /** Origin of {@link baseUrl} — credentials are only attached same-origin. */
+    private readonly baseOrigin;
     private readonly apiKey;
     private readonly getSessionToken;
     private readonly onUnauthorized;
@@ -2706,6 +2738,8 @@ declare class HttpClient {
      * up credentials without knowing about them.
      */
     readonly fetch: typeof fetch;
+    /** True when `input` resolves to {@link baseOrigin} (relative URLs always do). */
+    private isSameOrigin;
     get<T = unknown>(path: string): Promise<T>;
     post<T = unknown>(path: string, body?: unknown): Promise<T>;
     patch<T = unknown>(path: string, body?: unknown): Promise<T>;
@@ -2713,6 +2747,410 @@ declare class HttpClient {
     private request;
 }
 
+/**
+ * `LWWRegister` — a last-write-wins register CRDT, the conflict model for a
+ * `kv` value and for an app-state snapshot. A register holds a single value
+ * stamped with the {@link HlcTimestamp} of the write that produced it. Two
+ * concurrent writes converge to the one with the greater HLC; the loser is
+ * discarded. A delete is just a write that sets `deleted` (a tombstone), so a
+ * stale write that arrives after a newer delete can't resurrect the value.
+ *
+ * Because the HLC total-orders every write deterministically (down to a nodeId
+ * tiebreak), every replica that has seen the same set of writes lands on the
+ * same value — that's the convergence guarantee.
+ */
+interface LwwRegister<T> {
+    /** The current value, or `null` when tombstoned / never written. */
+    value: T | null;
+    /** HLC of the write that produced this state. */
+    hlc: string;
+    /** True when the latest write was a delete. */
+    deleted: boolean;
+}
+/** An empty register that loses to any real write. */
+declare function emptyRegister<T>(): LwwRegister<T>;
+/**
+ * Merge two register states, returning the winner (greater HLC). Pure: neither
+ * input is mutated. Used identically on the inbound change feed and on
+ * sync-replay reconciliation so there's exactly one definition of "who wins".
+ */
+declare function mergeRegister<T>(a: LwwRegister<T>, b: LwwRegister<T>): LwwRegister<T>;
+/** Build the register produced by a `set`. */
+declare function writeRegister<T>(value: T, hlc: string): LwwRegister<T>;
+/** Build the register produced by a `delete` (a tombstone at `hlc`). */
+declare function deleteRegister<T>(hlc: string): LwwRegister<T>;
+
+/**
+ * `ConnectivityManager` — the single source of truth for "are we online", which
+ * the offline layer needs to decide between a network call and a cache read, and
+ * to know when to flush the durable outbound queue.
+ *
+ * `navigator.onLine` alone lies often (captive portals, VPN flaps, a laptop
+ * that's "connected" to a network with no route), so we fuse three signals:
+ *   1. the browser `online`/`offline` events (coarse but free),
+ *   2. real fetch outcomes reported by {@link ../core/HttpClient} and the shard
+ *      client — a thrown `TypeError`/abort is the most reliable "offline" tell,
+ *      and a 2xx is the most reliable "online" tell,
+ *   3. the sync engine, which flips us to `syncing` while it drains the queue.
+ *
+ * The offline→online edge fires `onReconnect` (wired to the sync engine) so
+ * queued writes replay automatically. Transitions are debounced to avoid
+ * flapping the UI on a brief blip. State changes also emit on {@link EventCore}
+ * (`ONLINE`/`OFFLINE`/`SYNCING`) so apps can render a status indicator.
+ */
+type ConnectivityState = "online" | "offline" | "syncing";
+interface ConnectivityOptions {
+    /** Called on each offline→online transition (drives queue replay). */
+    onReconnect?: () => void;
+    /** Debounce window for offline transitions, ms. Default 1500. */
+    debounceMs?: number;
+}
+declare class ConnectivityManager {
+    private state;
+    private readonly listeners;
+    private readonly onReconnect?;
+    private readonly debounceMs;
+    private offlineTimer;
+    private started;
+    private readonly handleOnline;
+    private readonly handleOffline;
+    constructor(opts?: ConnectivityOptions);
+    /** Attach to the browser online/offline events. Safe to call in Node (no-op). */
+    start(): void;
+    stop(): void;
+    get current(): ConnectivityState;
+    get isOnline(): boolean;
+    /** Subscribe to state changes. Returns an unsubscribe function. */
+    onChange(cb: (state: ConnectivityState) => void): () => void;
+    /** Report a failed network attempt (thrown fetch / abort). */
+    reportFetchFailure(): void;
+    /** Report a successful network round-trip — strongest "we're online" signal. */
+    reportFetchSuccess(): void;
+    /** The sync engine entering its drain phase. */
+    markSyncing(): void;
+    /** The sync engine finished — settle back to online. */
+    markSynced(): void;
+    private markOnline;
+    private scheduleOffline;
+    private set;
+}
+
+type StoreName = "kv-cache" | "db-row-cache" | "db-query-cache" | "space-messages" | "space-cursors" | "outbound-queue" | "snapshots" | "hlc-state" | "meta";
+
+/**
+ * `OfflineStore` — the pluggable persistence interface the offline layer is
+ * built on, mirroring the {@link ../../core/Session.SessionStore} pattern. The
+ * default browser implementation is {@link ./IndexedDbStore}; environments
+ * without IndexedDB (Node, Workers, SSR) get {@link ./NoopStore}, whose every
+ * method resolves to empty so the namespace hooks become branch-free no-ops.
+ *
+ * Keys are plain strings (most are prefixed with the user's `commitment` to
+ * isolate users on a shared origin). Values are whatever the caller stores —
+ * the store is format-agnostic; CRDT/ciphertext shape is the namespace's
+ * concern.
+ */
+
+/** A durable outbound mutation awaiting replay on reconnect. */
+interface QueueEntry {
+    /** Auto-assigned monotonic sequence (insertion order). */
+    seq: number;
+    /** HLC stamp of the mutation — the order replays run in. */
+    hlc: string;
+    /** Client-generated id for idempotent replay / dedupe. */
+    clientId: string;
+    domain: "kv" | "db" | "file" | "space" | "snapshot";
+    /** Namespace method to re-invoke (e.g. `"set"`, `"update"`, `"sendMessage"`). */
+    method: string;
+    /** Serializable arguments captured at enqueue time. */
+    args: unknown;
+}
+interface OfflineEntry<T> {
+    key: string;
+    value: T;
+}
+interface OfflineStore {
+    /** False for {@link ./NoopStore} so hooks can skip all work cheaply. */
+    readonly enabled: boolean;
+    /** Resolve once the backing store is open and ready (no-op when disabled). */
+    ready(): Promise<void>;
+    get<T>(store: StoreName, key: string): Promise<T | null>;
+    put<T>(store: StoreName, key: string, value: T): Promise<void>;
+    delete(store: StoreName, key: string): Promise<void>;
+    /** Entries whose key starts with `prefix`, in ascending key order. */
+    prefix<T>(store: StoreName, prefix: string): Promise<Array<OfflineEntry<T>>>;
+    /** Entries whose key is in `[lower, upper)`, in ascending key order. */
+    range<T>(store: StoreName, lower: string, upper: string): Promise<Array<OfflineEntry<T>>>;
+    /** Every entry in a store, in ascending key order. */
+    all<T>(store: StoreName): Promise<Array<OfflineEntry<T>>>;
+    clear(store: StoreName): Promise<void>;
+    /** Append a mutation to the durable outbound queue; resolves with its seq. */
+    enqueue(entry: Omit<QueueEntry, "seq">): Promise<number>;
+    /** Remove a drained queue entry by seq. */
+    dequeue(seq: number): Promise<void>;
+    /** All queued mutations, HLC-ordered (the order to replay them in). */
+    queued(): Promise<QueueEntry[]>;
+}
+
+/**
+ * `OutboundQueue` — the durable record of writes made while offline (or that
+ * failed mid-flight) plus the machinery to replay them on reconnect. This is
+ * what makes offline writes *survive a reload*: unlike the in-memory buffer in
+ * {@link ../transport/WSTransport}, every entry lives in IndexedDB until it has
+ * been acknowledged by the server.
+ *
+ * Each domain registers a **replayer** — a function that re-applies one queued
+ * mutation by re-invoking the real namespace method (with an `isReplay` flag so
+ * it doesn't re-enqueue). `drain()` replays entries in HLC order:
+ *   - success → remove the entry;
+ *   - permanent failure (4xx) → drop it and surface a `SYNC_ERROR` (a write the
+ *     server will never accept must not wedge the queue forever);
+ *   - transient/network failure → stop draining and leave the rest for the next
+ *     reconnect.
+ *
+ * Replays are idempotent by construction (kv/db are LWW-by-key, messages dedupe
+ * by `clientId`, file PUTs are content-addressed), so re-running a partially
+ * drained queue is safe.
+ */
+
+type Replayer = (entry: QueueEntry) => Promise<void>;
+declare class OutboundQueue {
+    private readonly store;
+    private readonly replayers;
+    private draining;
+    constructor(store: OfflineStore);
+    /** A domain registers how to replay its mutations. */
+    register(domain: QueueEntry["domain"], replayer: Replayer): void;
+    /** Record a mutation for later replay; resolves with its assigned seq. */
+    enqueue(entry: Omit<QueueEntry, "seq">): Promise<number>;
+    /** Number of writes still awaiting sync. */
+    pending(): Promise<number>;
+    /**
+     * Replay queued mutations in HLC order. Coalesces concurrent calls into a
+     * single in-flight drain. Stops on the first transient failure, leaving the
+     * remaining entries for the next attempt.
+     */
+    drain(): Promise<void>;
+    private runDrain;
+}
+
+/**
+ * `SyncEngine` — orchestrates catch-up when the client comes back online. It's
+ * the thing wired to the {@link ConnectivityManager}'s offline→online edge.
+ *
+ * One `run()` does, in order:
+ *   1. **Guard** — only proceed when the session is authenticated and unlocked
+ *      (replays may need to re-seal/re-encrypt, and there's no point pushing
+ *      writes for a logged-out user).
+ *   2. **Drain** the durable {@link OutboundQueue} — push every offline write.
+ *   3. **Catch-up tasks** — domain-registered pulls that reconcile *inbound*
+ *      state we missed while offline (e.g. a Space paging history forward to its
+ *      last-seen handle). Registered by the namespaces.
+ *
+ * Concurrent triggers coalesce into a single in-flight run (a reconnect often
+ * fires several signals at once), mirroring `Client.recoverInFlight`.
+ */
+
+interface SyncEngineDeps {
+    queue: OutboundQueue;
+    connectivity: ConnectivityManager;
+    /** Proceed only when this returns true (authenticated + unlocked). */
+    canSync: () => boolean;
+}
+declare class SyncEngine {
+    private readonly deps;
+    private readonly catchUpTasks;
+    private running;
+    constructor(deps: SyncEngineDeps);
+    /** Register an inbound reconciliation task run after the queue drains. */
+    registerCatchUp(task: () => Promise<void>): () => void;
+    /** Drain + catch up. Concurrent calls share one in-flight run. */
+    run(): Promise<void>;
+    private execute;
+}
+
+/**
+ * `client.offline.snapshot` — a small, encrypted, app-state cache. Apps stash
+ * whatever they need to repaint instantly on a cold offline boot: the last open
+ * Space, a draft message, scroll position, the current route. It's deliberately
+ * separate from `client.kv`: snapshots are **local-only by default** (instant,
+ * never metered, never leave the device) and hold view state rather than domain
+ * data.
+ *
+ *   await client.offline.snapshot.save('ui', { route, openSpaceId, draft })
+ *   const ui = await client.offline.snapshot.load<UiState>('ui')
+ *
+ * Values are encrypted at rest with the same identity-derived {@link StorageCipher}
+ * as `client.kv`, so a snapshot is unreadable until the user unlocks — `load`
+ * returns `null` when locked or absent, and `save` throws {@link OfflineLockedError}.
+ * Conflict model is a single-writer LWW register (the latest save wins).
+ */
+
+interface SnapshotNamespaceDeps {
+    store: OfflineStore;
+    session: SessionState;
+    /** Stamp the saved record (LWW ordering); supplied by the OfflineManager. */
+    nextHlc: () => Promise<string>;
+}
+declare class SnapshotNamespace {
+    private readonly deps;
+    private cipher;
+    private cipherIdentity;
+    constructor(deps: SnapshotNamespaceDeps);
+    /** Persist `state` under `name` (encrypted). No-op when offline support is off. */
+    save<T = unknown>(name: string, state: T): Promise<void>;
+    /** Load and decrypt the snapshot `name`, or `null` if absent/locked. */
+    load<T = unknown>(name: string): Promise<T | null>;
+    /** Remove the snapshot `name`. */
+    delete(name: string): Promise<void>;
+    /** Names of all snapshots for the current user. */
+    list(): Promise<string[]>;
+    private key;
+    private commitment;
+    private requireCipher;
+}
+
+/**
+ * `ShardCache` — a Cache-API-backed store for file-shard bytes. Shards are
+ * content-addressed (the key IS the SHA-256 of the ciphertext), so caching them
+ * is uniquely safe: a cache hit is self-validating, immutable, and shareable
+ * across files. The Cache API (rather than IndexedDB) is the right home for
+ * large binary blobs — it streams, it's purpose-built for response bodies, and
+ * it has its own eviction.
+ *
+ * Keys are SYNTHETIC absolute URLs (`https://shard.muhkoo.local/<hash>`) rather
+ * than the real shard endpoint, so the cache is addressable by hash alone — the
+ * sync engine can re-PUT a deferred shard knowing only its hash, without
+ * reconstructing the accelerator URL. We never fetch these synthetic URLs; they
+ * exist only as cache keys.
+ *
+ * Every method degrades to a no-op / null where the Cache API is unavailable
+ * (Node, Workers, insecure contexts), so callers don't need to branch.
+ */
+declare class ShardCache {
+    static available(): boolean;
+    private key;
+    private open;
+    /** Cached shard bytes, or `null` on miss / when unavailable. */
+    get(hash: string): Promise<Uint8Array | null>;
+    /** Store shard bytes under their hash. Best-effort. */
+    put(hash: string, bytes: Uint8Array): Promise<void>;
+    /** Whether a shard is present in the cache. */
+    has(hash: string): Promise<boolean>;
+}
+
+/**
+ * `OfflineManager` — the object `client.offline` points at, and the single
+ * owner of everything the offline layer needs at runtime: the {@link
+ * OfflineStore}, the {@link HLC} (Hybrid Logical Clock), the {@link
+ * ConnectivityManager}, the durable {@link OutboundQueue}, the {@link
+ * SyncEngine}, and the {@link SnapshotNamespace}.
+ *
+ * The {@link ../core/Client} constructs one of these (always — it's a cheap
+ * no-op when offline support is off) and hands the namespaces the small set of
+ * primitives they need to participate: `nextHlc()` to stamp a write,
+ * `observeHlc()` to fold in a remote stamp, `enqueue()` to record an offline
+ * mutation, and `registerReplayer()`/`registerCatchUp()` to define how their
+ * domain re-syncs on reconnect. Keeping that wiring here means the namespaces
+ * stay decoupled from IndexedDB and the clock.
+ */
+
+interface OfflineManagerDeps {
+    store: OfflineStore;
+    session: SessionState;
+    /** Whether offline support is active (browser) vs a no-op (Node/Workers). */
+    enabled: boolean;
+}
+declare class OfflineManager {
+    /** True in browsers with IndexedDB; false when running over a NoopStore. */
+    readonly enabled: boolean;
+    readonly store: OfflineStore;
+    readonly connectivity: ConnectivityManager;
+    readonly queue: OutboundQueue;
+    readonly sync: SyncEngine;
+    /** `client.offline.snapshot` — encrypted app-state cache. */
+    readonly snapshot: SnapshotNamespace;
+    /** Cache-API store for file-shard bytes (browser only). */
+    readonly fileCache?: ShardCache;
+    private hlc;
+    private nodeId;
+    private readonly bootPromise;
+    private persistTimer;
+    constructor(deps: OfflineManagerDeps);
+    /**
+     * Queue a shard upload that couldn't reach the network. The bytes are
+     * already cached (keyed by `hash`), so only the hash is recorded; the file
+     * replayer re-PUTs from the cache on reconnect.
+     */
+    deferShardUpload(hash: string): Promise<void>;
+    /** Resolve once the clock + node id are loaded. */
+    ready(): Promise<void>;
+    /** Current connectivity state (`online` | `offline` | `syncing`). */
+    get status(): ConnectivityState;
+    /** Subscribe to connectivity changes. Returns an unsubscribe function. */
+    onStatusChange(cb: (state: ConnectivityState) => void): () => void;
+    /** Stamp a locally-generated write with a fresh, monotonic HLC. */
+    nextHlc(): Promise<string>;
+    /** Fold an observed remote HLC into the clock (call for inbound stamps). */
+    observeHlc(remote: string): Promise<void>;
+    /** A fresh client-generated id (idempotent replay / message dedupe). */
+    newClientId(): string;
+    /** Record an offline mutation for replay on reconnect. */
+    enqueue(entry: Omit<QueueEntry, "seq">): Promise<number>;
+    /** A domain registers how to replay its queued mutations. */
+    registerReplayer(domain: QueueEntry["domain"], replayer: Replayer): void;
+    /** A domain registers an inbound catch-up task (run after the queue drains). */
+    registerCatchUp(task: () => Promise<void>): () => void;
+    /** Surface a network failure to connectivity tracking. */
+    reportFetchFailure(): void;
+    /** Surface a successful round-trip to connectivity tracking. */
+    reportFetchSuccess(): void;
+    /** Tear down listeners (tests / hot-reload). */
+    dispose(): void;
+    private boot;
+    /** Coalesce HLC-state writes — a burst of stamps persists once. */
+    private schedulePersist;
+}
+
+/**
+ * `KvCache` — the offline adapter for `client.kv`. Stores each value's
+ * ciphertext envelope (never plaintext) under `${commitment}|${collection}/${id}`
+ * as an LWW-Register stamped with an HLC, so reads work offline and concurrent
+ * writes converge (see {@link ./crdt/LWWRegister}). Deletes are causal
+ * tombstones — a stale write can't resurrect a key a newer delete removed.
+ *
+ * True cross-device convergence also needs the accelerator to honor the HLC
+ * (see the server's `kvmeta` sidecar); this adapter embeds the stamp now and
+ * degrades gracefully (last-writer-by-arrival) until that ships.
+ */
+
+type KvEntry = LwwRegister<unknown>;
+declare class KvCache {
+    private readonly manager;
+    private readonly store;
+    constructor(manager: OfflineManager);
+    get enabled(): boolean;
+    nextHlc(): Promise<string>;
+    newClientId(): string;
+    private key;
+    /** Read the cached register for `collection/id`, or null when absent. */
+    read(commitment: string, fullKey: string): Promise<KvEntry | null>;
+    /** Optimistically record a local `set` (ciphertext envelope + HLC). */
+    writeLocal(commitment: string, fullKey: string, envelope: unknown, hlc: string): Promise<void>;
+    /** Optimistically record a local `delete` (tombstone at HLC). */
+    deleteLocal(commitment: string, fullKey: string, hlc: string): Promise<void>;
+    /**
+     * Merge an authoritative value (from a GET refresh or a realtime frame) into
+     * the cache by HLC. When the server doesn't supply an HLC yet, treat it as
+     * "now-ish" by stamping our clock so a server value still beats stale local
+     * state but a fresh local write wins.
+     */
+    mergeRemote(commitment: string, fullKey: string, envelope: unknown | null, op: "set" | "delete", hlc?: string): Promise<void>;
+    /** Non-tombstoned full keys for a commitment (used for offline `list`). */
+    liveKeys(commitment: string): Promise<string[]>;
+    /** Queue a kv mutation for replay on reconnect. */
+    enqueue(method: "set" | "delete", args: unknown, hlc: string, clientId: string): Promise<void>;
+}
+
 /**
  * `client.kv` — per-user key/value storage backed by the accelerator's personal
  * space.
@@ -2742,6 +3180,8 @@ interface KvNamespaceDeps {
     session: SessionState;
     /** WebSocket base (ws/wss) for the change feed; derived from baseUrl. */
     wsBaseUrl: string;
+    /** Offline cache + queue. Undefined ⇒ no offline behavior (network-only). */
+    offline?: KvCache;
 }
 interface SetOptions {
     /** Encrypt the value at rest (default: true). */
@@ -2759,6 +3199,8 @@ declare class KvNamespace {
     private cipher;
     private cipherIdentity;
     constructor(deps: KvNamespaceDeps);
+    /** Replay one queued kv mutation (called by the sync engine). */
+    replay(entry: QueueEntry): Promise<void>;
     /** Store `value` under `collection`/`id` (encrypted at rest by default). */
     set<T = unknown>(collection: string, id: string, value: T, opts?: SetOptions): Promise<void>;
     /** Fetch the value at `collection`/`id`, or `null` if absent. */
@@ -2787,6 +3229,45 @@ declare class KvNamespace {
     private getCipher;
 }
 
+/**
+ * `DbCache` — the offline adapter for `client.db`. Unlike kv, db rows are
+ * server-plaintext, so they're cached as-is. The SDK doesn't know a table's
+ * primary-key column, so it caches schema-agnostically:
+ *   - `get(id)` results keyed by the requested id (`${table}|row|${id}`),
+ *   - `query(q)` result pages keyed by a stable hash of the query.
+ *
+ * Writes carry per-column HLC stamps (`_hlc`) so the accelerator's per-column
+ * LWW merge can converge concurrent edits; offline writes are queued and
+ * replayed. Optimistic row patches keep `get` fresh between sync cycles.
+ */
+
+interface DbQueryPage {
+    rows: Array<Record<string, unknown>>;
+    nextCursor: string | null;
+}
+/** Stable JSON for query-cache keys (sorted object keys → deterministic). */
+declare function stableStringify(value: unknown): string;
+declare class DbCache {
+    private readonly manager;
+    private readonly store;
+    constructor(manager: OfflineManager);
+    get enabled(): boolean;
+    nextHlc(): Promise<string>;
+    newClientId(): string;
+    /** Build the `{ [col]: hlc }` map for a write (one stamp across its columns). */
+    columnStamps(values: Record<string, unknown>, hlc: string): Record<string, string>;
+    private rowKey;
+    private queryKey;
+    readRow(table: string, id: string): Promise<Record<string, unknown> | null>;
+    writeRow(table: string, id: string, row: Record<string, unknown>): Promise<void>;
+    /** Shallow-merge a partial update into a cached row (optimistic). */
+    patchRow(table: string, id: string, values: Record<string, unknown>): Promise<void>;
+    deleteRow(table: string, id: string): Promise<void>;
+    readQuery(table: string, q: unknown): Promise<DbQueryPage | null>;
+    writeQuery(table: string, q: unknown, page: DbQueryPage): Promise<void>;
+    enqueue(method: "insert" | "update" | "delete", args: unknown, hlc: string, clientId: string): Promise<void>;
+}
+
 /**
  * `client.db` — the app's scalable database. A developer defines tables in the
  * Muhkoo portal (columns + indexes); each table is backed by its own Durable
@@ -2818,6 +3299,8 @@ declare class KvNamespace {
 
 interface DbNamespaceDeps {
     http: HttpClient;
+    /** Offline row/query cache + write queue. Undefined ⇒ network-only. */
+    offline?: DbCache;
 }
 /** Comparison operators allowed in a {@link DbQuery} `where` clause. */
 type DbFilterOp = "eq" | "neq" | "gt" | "gte" | "lt" | "lte" | "in" | "like" | "likeStartsWith" | "likeContains";
@@ -2851,8 +3334,10 @@ interface DbQueryResult<T = Record<string, unknown>> {
 declare class DbTable<T extends Record<string, unknown> = Record<string, unknown>> {
     private readonly http;
     private readonly name;
-    constructor(http: HttpClient, name: string);
+    private readonly offline?;
+    constructor(http: HttpClient, name: string, offline?: DbCache | undefined);
     private base;
+    private rowUrl;
     /** Insert a row. Returns the created row and its primary-key value. */
     insert(values: Partial<T>): Promise<{
         row: T;
@@ -2880,6 +3365,8 @@ declare class DbNamespace {
      *   const todos = client.db.table<Todo>('todos');
      */
     table<T extends Record<string, unknown> = Record<string, unknown>>(name: string): DbTable<T>;
+    /** Replay one queued db mutation (called by the sync engine). */
+    replay(entry: QueueEntry): Promise<void>;
 }
 
 /**
@@ -2919,6 +3406,10 @@ interface FileNamespaceDeps {
      * deploy-time-precompiled environments). Forwarded to {@link FileStorage}.
      */
     rsWasmModule?: WebAssembly.Module;
+    /** Offline shard-byte cache (browser). Enables offline reads of cached files. */
+    shardCache?: ShardByteCache;
+    /** Queue a shard PUT that couldn't reach the network (offline). */
+    deferShardUpload?: (hash: string) => Promise<void>;
 }
 interface WriteFileOptions {
     /** SharedSpace the file is written to (obtain via `client.space`). */
@@ -3304,6 +3795,46 @@ interface SpaceMessageEvent {
      */
     handle: number;
     message: Message;
+    /**
+     * Sender-generated id, present on locally-originated messages (carried in the
+     * cleartext `cid` header). Lets the UI dedupe an optimistic send against its
+     * server echo, and the offline cache replace a pending entry with the real one.
+     */
+    clientId?: string;
+    /** True for an optimistic local send not yet acknowledged by the server. */
+    pending?: boolean;
+}
+/**
+ * One sealed message frame as cached for offline use. The `packet` is the
+ * ciphertext-bearing serialized {@link Packet} (decrypted lazily on read), so
+ * nothing readable is persisted. Structurally matches the offline layer's
+ * `MessageEntry`; declared here so the spaces module doesn't import `../offline`.
+ */
+interface CachedSpaceMessage {
+    handle: string;
+    packet: string | null;
+    op: "msg" | "edit" | "delete";
+    clientId?: string;
+    hlc?: string;
+    pending?: boolean;
+    deleted?: boolean;
+}
+/** The offline adapter a {@link Space} drives. Implemented by `SpaceCache`. */
+interface SpaceOfflineAdapter {
+    readonly enabled: boolean;
+    newClientId(): string;
+    nextHlc(): Promise<string>;
+    putMessage(spaceId: string, entry: CachedSpaceMessage): Promise<void>;
+    putDeleted(spaceId: string, handle: number): Promise<void>;
+    dropPending(spaceId: string, clientId: string): Promise<void>;
+    loadMessages(spaceId: string): Promise<CachedSpaceMessage[]>;
+    getCursor(spaceId: string): Promise<{
+        lastSeenHandle: number;
+        oldestHandle: number;
+    } | null>;
+    observeHandle(spaceId: string, handle: number): Promise<void>;
+    enqueueFrame(spaceId: string, frame: unknown, clientId: string, hlc: string): Promise<void>;
+    registerCatchUp(task: () => Promise<void>): () => void;
 }
 /**
  * An inbound ephemeral signal — an application broadcast the server relays to
@@ -3353,6 +3884,12 @@ interface SpaceDeps {
      * without a live websocket.
      */
     createChannel?: (url: string, myId: string) => SpaceChannelLike;
+    /** Offline shard-byte cache for room files (browser). */
+    shardCache?: ShardByteCache;
+    /** Queue a room-file shard PUT that couldn't reach the network. */
+    deferShardUpload?: (hash: string) => Promise<void>;
+    /** Offline message cache + send queue. Undefined ⇒ no offline behavior. */
+    offline?: SpaceOfflineAdapter;
 }
 /** The subset of {@link BroadcastChannel} a {@link Space} drives. */
 interface SpaceChannelLike {
@@ -3376,6 +3913,7 @@ declare class Space {
     /** Per-instance event bus for fan-out events (isolated across spaces). */
     private readonly events;
     private rawWired;
+    private catchUpUnsub;
     constructor(deps: SpaceDeps);
     /** The encoded space id (same as the transport name for fan-out spaces). */
     get id(): string;
@@ -3425,6 +3963,14 @@ declare class Space {
      * original author. Receivers get an {@link onMessageDeleted} event.
      */
     deleteMessage(handle: number): Promise<void>;
+    /**
+     * Decrypt and return the locally-cached message log for this space, in
+     * handle order (pending sends last). Works offline — the source is the
+     * IndexedDB cache populated by live frames + {@link history}. Apps call this
+     * on boot to paint instantly, then subscribe to {@link onMessage} for live
+     * updates. Returns `[]` when offline support is off.
+     */
+    cachedMessages(): Promise<SpaceMessageEvent[]>;
     /** Subscribe to in-place edits of persisted messages (new content at the same handle). */
     onMessageEdited(handler: (e: SpaceMessageEvent) => void): () => void;
     /** Subscribe to deletions of persisted messages. */
@@ -3506,6 +4052,15 @@ declare class Space {
      * nothing to verify against → reject.
      */
     private verifySender;
+    /** Persist a decoded live/history/edit frame to the offline cache. */
+    private cacheFrame;
+    /**
+     * Inbound reconciliation run on reconnect: page the server's forward delta
+     * (`?since=<lastSeenHandle>`) to the head, pulling exactly the messages that
+     * landed while we were offline into the cache. Bounded so a long absence
+     * can't page forever. Falls back gracefully if the endpoint is unavailable.
+     */
+    private catchUp;
     private emitEvent;
     private requireKeyring;
     private requireCipher;
@@ -3638,9 +4193,14 @@ interface SpaceNamespaceDeps {
     wsBaseUrl: string;
     /** Optional PersonalSpace-backed cache of group keys (encrypted at rest). */
     cache?: SpaceKeyCache;
+    /** Offline manager — enables message caching + offline send replay. */
+    offline?: OfflineManager;
 }
 declare class SpaceNamespace {
     private readonly deps;
+    private spaceCache?;
+    /** Spaces built this session, by id — used to route offline send replays. */
+    private readonly openSpaces;
     constructor(deps: SpaceNamespaceDeps);
     /**
      * Create a new space: generate its keypair (public key = id), register
@@ -4085,6 +4645,22 @@ interface ClientOptions {
      * staging (`auth.staging.muhkoo.dev`) or a self-hosted deployment.
      */
     authBaseUrl?: string;
+    /**
+     * Offline support (`client.offline`) — transparent local caching + a durable
+     * write queue + CRDT sync. **On by default in browsers** (IndexedDB + Cache
+     * API present), a no-op everywhere else. Override to force it on/off or to
+     * supply a custom {@link OfflineStore}.
+     */
+    offline?: {
+        /** Force enable/disable. Default: auto-detect (browser on, Node off). */
+        enabled?: boolean;
+        /** Pluggable persistence. Default: IndexedDB in the browser. */
+        store?: OfflineStore;
+        /** Cache file-shard bytes in the Cache API. Default: true in the browser. */
+        cacheShards?: boolean;
+        /** Soft cap on durable-queue bytes before degrading to online-only. */
+        maxQueueBytes?: number;
+    };
 }
 declare class Client {
     readonly baseUrl: string;
@@ -4104,6 +4680,8 @@ declare class Client {
     readonly agents: AgentsNamespace;
     /** Serverless functions — `client.functions.deploy(appId, …)`, etc. */
     readonly functions: FunctionsNamespace;
+    /** Offline cache + sync — `client.offline.status`, `client.offline.snapshot`, etc. */
+    readonly offline: OfflineManager;
     private readonly session;
     private readonly http;
     /** Subscribers notified when a session expires and can't be recovered. */
@@ -4264,6 +4842,322 @@ declare function ejectAgentTools(appClass: Function, opts?: {
     maxIterations?: number;
 }): AgentToolsConfig;
 
+/**
+ * Message-log helpers — the conflict model for a Space's message history.
+ *
+ * Messages are the easy CRDT: the accelerator assigns every persisted message a
+ * monotonic, zero-padded `handle` that already totally-orders the log, and the
+ * sealed body is immutable. So the "log" is just a grow-only set keyed by
+ * `handle`, and convergence is structural — no server change needed.
+ *
+ * The only subtleties this module encodes:
+ *   - **Optimistic sends** have no server handle yet. We key them by a
+ *     provisional handle that sorts *after* every real one, and tag them with
+ *     the sender's `clientId` so the real frame (carrying the same `clientId`)
+ *     can replace the placeholder instead of duplicating it.
+ *   - **Edits** are a per-message LWW register on the body (greater HLC wins).
+ *   - **Deletes** are a tombstone at the message's handle.
+ */
+type MessageOp = "msg" | "edit" | "delete";
+interface MessageEntry {
+    /** Server-assigned handle, or a {@link provisionalHandle} while pending. */
+    handle: string;
+    /** Sealed packet string (ciphertext at rest); `null` for a delete tombstone. */
+    packet: string | null;
+    op: MessageOp;
+    /** Sender-generated id, present on locally-originated sends for dedupe. */
+    clientId?: string;
+    /** HLC stamp — orders edits to the same message. */
+    hlc?: string;
+    /** True while an optimistic send has not yet been acked by the server. */
+    pending?: boolean;
+    deleted?: boolean;
+}
+/** IndexedDB key for a message within a space. */
+declare function messageKey(spaceId: string, handle: string): string;
+/**
+ * A handle for an un-acked optimistic message. Prefixed with `"~"` (0x7E),
+ * which sorts after every digit, so pending sends always appear at the tail of
+ * the handle-ordered log until the real handle arrives.
+ */
+declare function provisionalHandle(clientId: string): string;
+declare function isProvisional(handle: string): boolean;
+/**
+ * Merge two entries for the SAME handle. A delete always wins (tombstone); an
+ * edit wins over the entry it supersedes when its HLC is greater; otherwise the
+ * existing entry stands (a re-delivered `msg` is idempotent).
+ */
+declare function mergeMessage(local: MessageEntry | null, incoming: MessageEntry): MessageEntry;
+
+/**
+ * `SpaceCache` — the offline adapter a {@link ../spaces/Space} talks to. It
+ * persists sealed message frames (ciphertext at rest), tracks per-space sync
+ * cursors, and records offline sends in the durable queue. Kept as its own
+ * object (rather than wiring the Space straight to the store + clock) so the
+ * Space stays decoupled from IndexedDB and so the no-op path is a single
+ * `enabled` check.
+ *
+ * Messages are the structural CRDT (see {@link ./crdt/MessageLog}): the server
+ * assigns a monotonic `handle` that totally-orders the log, so the cache just
+ * stores frames keyed by a zero-padded handle (real) or a provisional key
+ * (pending sends, which sort to the tail until their echo arrives).
+ */
+
+/** Zero-pad a numeric server handle so string keys sort in handle order. */
+declare function padHandle(handle: number): string;
+interface SpaceCursor {
+    lastSeenHandle: number;
+    oldestHandle: number;
+    fullyBackfilled: boolean;
+}
+/**
+ * The surface a {@link ../spaces/Space} uses. Declared structurally on the
+ * Space side too (as `SpaceOfflineAdapter`) so the spaces module never imports
+ * the offline module.
+ */
+declare class SpaceCache {
+    private readonly manager;
+    private readonly store;
+    constructor(manager: OfflineManager);
+    get enabled(): boolean;
+    newClientId(): string;
+    nextHlc(): Promise<string>;
+    /** Persist a sealed message frame keyed by its (real or provisional) handle. */
+    putMessage(spaceId: string, entry: MessageEntry): Promise<void>;
+    /** Tombstone the message at `handle`. */
+    putDeleted(spaceId: string, handle: number): Promise<void>;
+    /** Drop a pending (optimistic) entry once its real echo has been stored. */
+    dropPending(spaceId: string, clientId: string): Promise<void>;
+    /** All cached frames for a space, in handle order (pending ones last). */
+    loadMessages(spaceId: string): Promise<MessageEntry[]>;
+    getCursor(spaceId: string): Promise<SpaceCursor | null>;
+    /** Advance the last-seen handle (monotonic) and track the oldest fetched. */
+    observeHandle(spaceId: string, handle: number): Promise<void>;
+    /** Queue a raw space frame for replay when the connection returns. */
+    enqueueFrame(spaceId: string, frame: unknown, clientId: string, hlc: string): Promise<void>;
+    /** Register an inbound catch-up task (forward/back history paging). */
+    registerCatchUp(task: () => Promise<void>): () => void;
+}
+
+/**
+ * Errors specific to the offline layer.
+ */
+/**
+ * Thrown when an offline read/write needs the user's identity (to decrypt or
+ * re-encrypt cached data) but the client is locked — typically right after a
+ * reload, where only the session token was restored and `unlock()` hasn't run
+ * yet. Distinct from the generic "not signed in" identity error so apps can
+ * specifically prompt the user to unlock to see their offline data.
+ */
+declare class OfflineLockedError extends Error {
+    constructor(message?: string);
+}
+
+/**
+ * Environment probe deciding whether the offline layer turns itself on. Offline
+ * support is **on by default in browsers** and a no-op everywhere else, so this
+ * is the gate the {@link ../core/Client} consults to pick {@link
+ * ./store/IndexedDbStore} vs {@link ./store/NoopStore}.
+ *
+ * We require all three web APIs the layer leans on — `indexedDB` (structured
+ * cache + durable queue), the Cache API (file-shard bytes), and a `window`
+ * (so we're in a real document with online/offline events) — and we *touch*
+ * them inside a try/catch, because some sandboxed or private-mode contexts
+ * expose the globals but throw on use (mirrors `defaultSessionStore`).
+ */
+declare function isOfflineCapable(): boolean;
+
+/**
+ * `IndexedDbStore` — the browser {@link OfflineStore}, backed by one IndexedDB
+ * database per origin (see {@link ./schema}). It opens lazily on first use and
+ * memoizes the connection. The queue methods sit on the autoincrement
+ * `outbound-queue` store and return mutations in HLC order for the sync engine.
+ *
+ * Construct only where `indexedDB` exists — {@link ../detect.isOfflineCapable}
+ * gates this, and the {@link ../../core/Client} falls back to {@link ./NoopStore}
+ * everywhere else.
+ */
+
+declare class IndexedDbStore implements OfflineStore {
+    readonly enabled = true;
+    private conn;
+    private opening;
+    private connect;
+    ready(): Promise<void>;
+    get<T>(store: StoreName, key: string): Promise<T | null>;
+    put<T>(store: StoreName, key: string, value: T): Promise<void>;
+    delete(store: StoreName, key: string): Promise<void>;
+    prefix<T>(store: StoreName, prefix: string): Promise<Array<OfflineEntry<T>>>;
+    range<T>(store: StoreName, lower: string, upper: string): Promise<Array<OfflineEntry<T>>>;
+    all<T>(store: StoreName): Promise<Array<OfflineEntry<T>>>;
+    clear(store: StoreName): Promise<void>;
+    enqueue(entry: Omit<QueueEntry, "seq">): Promise<number>;
+    dequeue(seq: number): Promise<void>;
+    queued(): Promise<QueueEntry[]>;
+}
+
+/**
+ * `NoopStore` — the {@link OfflineStore} used wherever offline support is off
+ * (Node, Workers, SSR, or when a consumer disables it). Every read returns
+ * empty and every write is dropped, so the namespace hooks that call into it
+ * behave exactly as they did before the offline layer existed. `enabled` is
+ * `false` so hot paths can skip the call entirely.
+ */
+
+declare class NoopStore implements OfflineStore {
+    readonly enabled = false;
+    ready(): Promise<void>;
+    get<T>(_store: StoreName, _key: string): Promise<T | null>;
+    put<T>(_store: StoreName, _key: string, _value: T): Promise<void>;
+    delete(_store: StoreName, _key: string): Promise<void>;
+    prefix<T>(_store: StoreName, _prefix: string): Promise<Array<OfflineEntry<T>>>;
+    range<T>(_store: StoreName, _lower: string, _upper: string): Promise<Array<OfflineEntry<T>>>;
+    all<T>(_store: StoreName): Promise<Array<OfflineEntry<T>>>;
+    clear(_store: StoreName): Promise<void>;
+    enqueue(_entry: Omit<QueueEntry, "seq">): Promise<number>;
+    dequeue(_seq: number): Promise<void>;
+    queued(): Promise<QueueEntry[]>;
+}
+
+/** The smallest possible stamp — used as the "nothing stored yet" sentinel so a
+ *  first real write always wins (`compareHlc(real, ZERO_HLC) > 0`). */
+declare const ZERO_HLC: string;
+interface HlcParts {
+    /** Physical wall-clock time, milliseconds since the Unix epoch. */
+    wall: number;
+    /** Logical counter within `wall`. */
+    counter: number;
+    /** Stable per-install node id (tiebreak). */
+    nodeId: string;
+}
+/** Pack the three components into the sortable string form. */
+declare function pack(wall: number, counter: number, nodeId: string): string;
+/** Parse a packed stamp back into its components. Tolerates the empty/zero
+ *  sentinel. Throws on a malformed string so corruption surfaces loudly. */
+declare function unpack(stamp: string): HlcParts;
+/**
+ * Total order over packed HLC strings: negative if `a < b`, positive if
+ * `a > b`, `0` only when they are byte-identical. Because the fields are
+ * fixed-width and ordered (wall, counter, nodeId), a single string comparison
+ * already yields causal order — this helper just normalizes the result to the
+ * `-1 | 0 | 1` shape callers expect.
+ */
+declare function compareHlc(a: string, b: string): number;
+/** Convenience: is `a` strictly newer than `b`? */
+declare function isNewer(a: string, b: string): boolean;
+
+/**
+ * `HLC` — a Hybrid Logical Clock. Hands out monotonically increasing
+ * {@link HlcTimestamp} stamps that (a) track real time closely enough to be
+ * human-meaningful, yet (b) never go backwards, even across a reload or when a
+ * peer's clock is ahead of ours.
+ *
+ * Two operations, both the textbook HLC algorithm (Kulkarni et al.):
+ *   - `now()` — stamp a local event.
+ *   - `update(remote)` — observe a remote stamp (e.g. arriving on the realtime
+ *     change feed) and advance our clock past it, so any event we generate
+ *     afterwards is causally `> remote`.
+ *
+ * State is just `{ wall, counter }`; `nodeId` is fixed for the install. The
+ * owner ({@link ../OfflineManager}) seeds the clock from persisted state on
+ * boot and persists `getState()` after each tick so monotonicity survives page
+ * reloads — without that, a reload could mint a stamp that loses to one written
+ * seconds earlier.
+ */
+
+interface HlcState {
+    wall: number;
+    counter: number;
+}
+/** Injected physical-time source — defaults to `Date.now`. Overridable so
+ *  tests can drive the clock deterministically. */
+type PhysicalClock = () => number;
+declare class HLC {
+    private wall;
+    private counter;
+    private readonly nodeId;
+    private readonly physical;
+    constructor(nodeId: string, opts?: {
+        state?: HlcState | null;
+        physical?: PhysicalClock;
+    });
+    /** Stamp a locally-generated event. Advances the clock. */
+    now(): string;
+    /**
+     * Merge in an observed remote stamp and advance our clock strictly past it.
+     * Call this for every inbound HLC (change-feed frames, history rows) so the
+     * next `now()` is causally after anything we've seen.
+     */
+    update(remote: HlcParts): string;
+    /** The current stamp without advancing the clock. */
+    current(): string;
+    /** Serializable `{ wall, counter }` for persistence. */
+    getState(): HlcState;
+}
+
+/**
+ * `LWWMap` — a map of independent last-write-wins registers, one per column.
+ * This is the conflict model for a `db` row: two devices that edit *different*
+ * columns of the same row while offline both keep their edits (no lost update),
+ * and two that edit the *same* column converge to the greater-HLC write. A row
+ * delete is a causal tombstone (see {@link ./ORSet}); a later write to any
+ * column resurrects the row with just the surviving columns.
+ *
+ * This mirrors, on the client, exactly what the accelerator's `_muhkoo_crdt`
+ * sidecar does server-side — so a row materializes identically whether it was
+ * merged locally (offline) or by the server on replay.
+ */
+interface LwwMap {
+    /** Per-column value of the winning write. */
+    fields: Record<string, unknown>;
+    /** Per-column HLC of the winning write. */
+    columnHlc: Record<string, string>;
+    /** Row-delete tombstone HLC, or `null` when the row was never deleted. */
+    tombstone: string | null;
+}
+declare function emptyMap(): LwwMap;
+/** Apply a local column write (insert/update) at the given per-column HLCs. */
+declare function writeColumns(map: LwwMap, values: Record<string, unknown>, hlc: string): LwwMap;
+/** Apply a row delete at `hlc` (causal tombstone). */
+declare function tombstoneRow(map: LwwMap, hlc: string): LwwMap;
+/** Merge two row states column-by-column. Pure; neither input is mutated. */
+declare function mergeMap(a: LwwMap, b: LwwMap): LwwMap;
+/**
+ * Materialize the visible row from merged state, or `null` when the row is
+ * deleted. A column is visible only when its write is causally newer than the
+ * tombstone — so a delete hides every prior column, but a post-delete write to
+ * a column brings the row back with just that column populated.
+ */
+declare function materializeRow(map: LwwMap): Record<string, unknown> | null;
+
+/**
+ * Tombstone helpers shared by the LWW CRDTs. We don't need a full
+ * observed-remove set — every domain that deletes (kv keys, db rows) does so
+ * by stamping a delete with an HLC and keeping that stamp around. The only
+ * rule that matters is the causal one:
+ *
+ *   a delete at HLC `d` hides the value, but a *later* write at HLC `w > d`
+ *   resurrects it; a *stale* write at `w <= d` is dropped.
+ *
+ * Keeping the delete HLC (rather than physically forgetting the key) is what
+ * prevents a delayed offline write from "un-deleting" something a peer already
+ * removed. Callers GC tombstones older than any possible offline window.
+ */
+/**
+ * Does a write at `writeHlc` win against a tombstone at `tombstoneHlc`?
+ * `true` ⇒ the write applies (resurrecting a deleted item if needed); `false`
+ * ⇒ the tombstone still holds and the write is dropped. A missing tombstone
+ * (`null`) means there's nothing suppressing the write.
+ */
+declare function writeBeatsTombstone(writeHlc: string, tombstoneHlc: string | null): boolean;
+/**
+ * Does a delete at `deleteHlc` win against the latest write at `writeHlc`?
+ * `true` ⇒ the item is now tombstoned. Ties go to the delete (remove-wins) so
+ * that a delete and a write stamped in the same instant resolve deterministically
+ * toward removal.
+ */
+declare function deleteBeatsWrite(deleteHlc: string, writeHlc: string | null): boolean;
+
 /**
  * KeyringClient — HTTP implementation of {@link KeyringTransport} against the
  * accelerator's per-space keyring endpoints. All blobs are opaque to the
@@ -4324,5 +5218,5 @@ declare class KeyringClient implements KeyringTransport {
     fetchMetadata(): Promise<SpaceMetadata | null>;
 }
 
-export { AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AgentsNamespace, AuthClient, AuthNamespace, AuthPublicInput, Authenticator, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, Client, DEFAULT_AUTH_BASE_URL, DEFAULT_BASE_URL, DEFAULT_FN_HOST_SUFFIX, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HashKnowledge, HttpClient, HttpError, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KvNamespace, LocalStorageSessionStore, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, PBKDF2_DEFAULT_ITERATIONS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PersonalSpaceClient, Poseidon, PreimagePoK, ReedSolomonCodec, Space as Room, SerializeMessage, SessionState, ShardClient, SharedSpaceClient, Space, SpaceKeyring, SpaceNamespace, SpacePacketCipher, StorageNamespace, VaultUnavailableError, WSTransport, ZkAuth, buildCommitment, compilePrograms, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultSessionStore, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, ejectAgentPrompt, ejectAgentTools, encodeToHex, encryptAesGcm, exportPublicKeyBase64, exportPublicKeyHex, generateAuthProof, generatePkce, getMuhkooAppDescriptor, getSubtle, initBn128Wasm, initRsWasm, initializeCircuits, manifestToStat, poseidonHash, quickVerify, randomBytes, randomState, sealSeed, shardHash, signMessage, toField, unsealSeed, unwrapWithPassphrase, verify, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase };
-export type { ACL, ACLEntry, AgentConfig, AgentCreateInput, AgentDbToolMode, AgentProvisioned, AgentScopeOpts, AgentSkill, AgentToolsConfig, AgentTrigger, AgentTriggerType, AgentUpdateInput, AgentsNamespaceDeps, AuthClientOptions, AuthKeyPair, AuthSuccess, AuthToken, AuthType, AuthUser, Bn128WasmInstance, BroadcastChannelEvent, BroadcastChannelOptions, ChannelLike, ChunkKeyMaterial, ChunkManifest, CipherFrame, CipherMessage, CipherMessageHeader, CircuitBufferConfig, CircuitUrls, ClientOptions, DehydratedKeypair, DehydratedKeys, DoubleRatchetCipherDeps, ECDHCurve, EncodeResult, EphemeralEvent, EpochKeyProvider, FileManifest, FileNamespaceDeps, FileStat, FileStorageOptions, FunctionCaps, FunctionConfig, FunctionDeployInput, FunctionInvokeOptions, FunctionScopeOpts, FunctionTrigger, FunctionTriggerType, FunctionTriggers, FunctionUpdateInput, FunctionsNamespaceDeps, Groth16Proof, HttpClientOptions, IncomingFrame, KeyExchangeFrame, KeyPair, Keypair, KeyringClientDeps, KeyringTransport, KvNamespaceDeps, LoginOptions, MessageBody, MessageDeletedEvent, MessageEvent, MessageHeaders, MessageNamespaceDeps, MessageOptions, MessageSubscription, MuhkooAgentMeta, MuhkooAgentToolsConfig, MuhkooAppDescriptor, MuhkooDBAccess, MuhkooDBMeta, MuhkooFunctionMeta, MuhkooMessageEvent, MuhkooSpaceMeta, OAuthProvider, PacketCipher, PacketHeaders, PacketOptions, Participant, Permission, PermissionCheckRequest, PermissionCheckResult, PersonalSpaceClientOptions, Pkce, PublicKeyJWK, RatchetState, ReceiveResult, RegisterParams, Role, SpaceDeps as RoomDeps, SpaceFileMetadata as RoomFileMetadata, SealedHandoff, SealedHeaders, Session, SessionOptions, SessionStore, SetOptions, ShardClientOptions, SharedSpaceClientOptions, SnarkProof, SpaceChannelLike, SpaceDeps, SpaceFileMetadata, SpaceKeyCache, SpaceKeyringDeps, SpaceMessageEvent, SpaceNamespaceDeps, StorageChangeEvent, StoredSession, Subscription, UserIdentity, VaultFactor, VerificationKey, WSMessage, WSMessageType, WSTransportOptions, WrappedPayload, WriteFileInput, WriteFileOptions, WriteToShardsInput, ZkAuthDeps, ZkAuthenticateRequest, ZkChallengeResponse, ZkCompiled, ZkIdentity, ZkRegisterRequest, ZkRegisterResponse };
+export { AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AgentsNamespace, AuthClient, AuthNamespace, AuthPublicInput, Authenticator, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, Client, ConnectivityManager, DEFAULT_AUTH_BASE_URL, DEFAULT_BASE_URL, DEFAULT_FN_HOST_SUFFIX, DbCache, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HLC, HashKnowledge, HttpClient, HttpError, IndexedDbStore, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KvCache, KvNamespace, LocalStorageSessionStore, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, NoopStore, OfflineLockedError, OfflineManager, OutboundQueue, PBKDF2_DEFAULT_ITERATIONS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PersonalSpaceClient, Poseidon, PreimagePoK, ReedSolomonCodec, Space as Room, SerializeMessage, SessionState, ShardCache, ShardClient, SharedSpaceClient, SnapshotNamespace, Space, SpaceCache, SpaceKeyring, SpaceNamespace, SpacePacketCipher, StorageNamespace, SyncEngine, VaultUnavailableError, WSTransport, ZERO_HLC, ZkAuth, buildCommitment, compareHlc, compilePrograms, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultSessionStore, deleteBeatsWrite, deleteRegister, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, ejectAgentPrompt, ejectAgentTools, emptyMap, emptyRegister, encodeToHex, encryptAesGcm, exportPublicKeyBase64, exportPublicKeyHex, generateAuthProof, generatePkce, getMuhkooAppDescriptor, getSubtle, initBn128Wasm, initRsWasm, initializeCircuits, isNewer, isOfflineCapable, isProvisional, manifestToStat, materializeRow, mergeMap, mergeMessage, mergeRegister, messageKey, pack, padHandle, poseidonHash, provisionalHandle, quickVerify, randomBytes, randomState, sealSeed, shardHash, signMessage, stableStringify, toField, tombstoneRow, unpack, unsealSeed, unwrapWithPassphrase, verify, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase, writeBeatsTombstone, writeColumns, writeRegister };
+export type { ACL, ACLEntry, AgentConfig, AgentCreateInput, AgentDbToolMode, AgentProvisioned, AgentScopeOpts, AgentSkill, AgentToolsConfig, AgentTrigger, AgentTriggerType, AgentUpdateInput, AgentsNamespaceDeps, AuthClientOptions, AuthKeyPair, AuthSuccess, AuthToken, AuthType, AuthUser, Bn128WasmInstance, BroadcastChannelEvent, BroadcastChannelOptions, CachedSpaceMessage, ChannelLike, ChunkKeyMaterial, ChunkManifest, CipherFrame, CipherMessage, CipherMessageHeader, CircuitBufferConfig, CircuitUrls, ClientOptions, ConnectivityOptions, ConnectivityState, DbQueryPage, DehydratedKeypair, DehydratedKeys, DoubleRatchetCipherDeps, ECDHCurve, EncodeResult, EphemeralEvent, EpochKeyProvider, FileManifest, FileNamespaceDeps, FileStat, FileStorageOptions, FunctionCaps, FunctionConfig, FunctionDeployInput, FunctionInvokeOptions, FunctionScopeOpts, FunctionTrigger, FunctionTriggerType, FunctionTriggers, FunctionUpdateInput, FunctionsNamespaceDeps, Groth16Proof, HlcParts, HlcState, HttpClientOptions, IncomingFrame, KeyExchangeFrame, KeyPair, Keypair, KeyringClientDeps, KeyringTransport, KvEntry, KvNamespaceDeps, LoginOptions, LwwMap, LwwRegister, MessageBody, MessageDeletedEvent, MessageEntry, MessageEvent, MessageHeaders, MessageNamespaceDeps, MessageOp, MessageOptions, MessageSubscription, MuhkooAgentMeta, MuhkooAgentToolsConfig, MuhkooAppDescriptor, MuhkooDBAccess, MuhkooDBMeta, MuhkooFunctionMeta, MuhkooMessageEvent, MuhkooSpaceMeta, OAuthProvider, OfflineEntry, OfflineManagerDeps, OfflineStore, PacketCipher, PacketHeaders, PacketOptions, Participant, Permission, PermissionCheckRequest, PermissionCheckResult, PersonalSpaceClientOptions, Pkce, PublicKeyJWK, QueueEntry, RatchetState, ReceiveResult, RegisterParams, Replayer, Role, SpaceDeps as RoomDeps, SpaceFileMetadata as RoomFileMetadata, SealedHandoff, SealedHeaders, Session, SessionOptions, SessionStore, SetOptions, ShardByteCache, ShardClientOptions, SharedSpaceClientOptions, SnapshotNamespaceDeps, SnarkProof, SpaceChannelLike, SpaceCursor, SpaceDeps, SpaceFileMetadata, SpaceKeyCache, SpaceKeyringDeps, SpaceMessageEvent, SpaceNamespaceDeps, SpaceOfflineAdapter, StorageChangeEvent, StoreName, StoredSession, Subscription, UserIdentity, VaultFactor, VerificationKey, WSMessage, WSMessageType, WSTransportOptions, WrappedPayload, WriteFileInput, WriteFileOptions, WriteToShardsInput, ZkAuthDeps, ZkAuthenticateRequest, ZkChallengeResponse, ZkCompiled, ZkIdentity, ZkRegisterRequest, ZkRegisterResponse };